Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT

Balonx Sistema is a Mexico-based Phishing-as-a-Service platform that rents phishing kits to affiliates, combining real-time WebSocket man-in-the-middle pages that can bypass multi-factor authentication, a commercial Android RAT (Spyroid-based) pushed via fake security alerts, and an AI-driven automated vishing module called CallFlow; researchers from Group-IB linked the platform to an operator using the handle “balonx,” reported claims of 1,100+ victims and ~350 rotating domains, and observed earnings reported in the panel.